Bug \XF\BbCode\Renderer\Html::renderTagTable corrupts tables on edit

[PaulB]

XenForo 2.2.9

\XF\BbCode\Renderer\Html::renderTagTable, line 1620:
PHP:

$rows[$i] = preg_replace('#</tr>$#', "$filler\0", $rows[$i]);
The backslash in the replacement text isn't escaped, so it results in a literal null byte instead of </tr>.

This causes unexpected behavior with certain malformed BB code tables that a confused user could accidentally create, such as:
Code:

[table]
[tr][td]a1[/td][td]b1[/td][/tr]
[tr][td]a2[/td][td]b2
[tr][td]a3[/td][td]b3[/td][/tr]
[/td][/tr][/table]

Repro:

1. ...

Read more

Continue reading...